WEBVTT

1
00:00.000 --> 00:02.740
So our next step here is on Gateway Zero,

2
00:02.740 --> 00:05.200
we're going to implement a Gateway firewall

3
00:05.200 --> 00:07.960
to permit HTTP traffic inbound

4
00:07.960 --> 00:10.060
if it's trying to reach the web server down here.

5
00:10.060 --> 00:12.880
So we currently have our destination net rule in place.

6
00:12.880 --> 00:19.780
So this Web10 machine out on this network maps to 23.1.2.181

7
00:19.780 --> 00:21.560
and down here on the 1010 Zero Network,

8
00:21.560 --> 00:23.840
its actual address is .181.

9
00:23.840 --> 00:27.360
Also, to implement the Gateway firewall functions on a Gateway,

10
00:27.360 --> 00:30.240
the Gateway needs to be associated with edge transport nodes.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

10
00:27.360 --> 00:30.240
the Gateway needs to be associated with edge transport nodes.

11
00:30.240 --> 00:32.880
And so currently it is because we've used this for other features

12
00:32.880 --> 00:35.560
like DHCP and so forth, as well as net,

13
00:35.560 --> 00:38.720
which also require the services of the transport nodes.

14
00:38.720 --> 00:41.640
So let's do a quick validation again from this Mint 23 machine

15
00:41.640 --> 00:44.960
that we can ping this VM based on its global address,

16
00:44.960 --> 00:47.960
that we can open up a web page to it based on its global address,

17
00:47.960 --> 00:51.800
and also that we have connectivity using TCP port 22.

18
00:51.800 --> 00:53.880
So here is this little web VM server,

19
00:53.880 --> 00:57.040
and it currently has FTP services, web services,

20
00:57.040 --> 00:59.120
SSH services, all running on it.

21
00:59.120 --> 01:01.760
Fantastic, let's go to Mint 23
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

21
00:59.120 --> 01:01.760
Fantastic, let's go to Mint 23

22
01:01.760 --> 01:04.080
and just verify that connectivity one more time.

23
01:04.080 --> 01:08.080
So here is Mint 23, this device sitting right there.

24
01:08.080 --> 01:13.520
We'll go to a command prompt and let's do a ping to 23.1.2.181.

25
01:13.520 --> 01:17.400
And that's working, I'll do a Control C, let's type in FTP

26
01:17.400 --> 01:20.960
to 23.1.2.181.

27
01:20.960 --> 01:23.120
And sure enough, it's prompting me to authenticate,

28
01:23.120 --> 01:25.800
so I'll do a Control C, we know that protocol is being allowed,

29
01:25.800 --> 01:27.960
that's FTP, let's do a telnet,

30
01:27.960 --> 01:30.240
to 23.1.2.181.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

30
01:27.960 --> 01:30.240
to 23.1.2.181.

31
01:30.240 --> 01:33.080
And we'll go to port 22, just to verify that that's open.

32
01:33.080 --> 01:35.400
And sure enough, it is, we'll cancel out of that.

33
01:35.400 --> 01:36.960
And we can also right here from the command line,

34
01:36.960 --> 01:40.080
use the command line URL with dash I to include headers

35
01:40.080 --> 01:43.600
to 23.1.2.181 plus center,

36
01:43.600 --> 01:46.720
and that's responding as well, including the content,

37
01:46.720 --> 01:49.240
right there from the index.html page,

38
01:49.240 --> 01:52.360
indicating it's the server at 1010.0181.

39
01:52.360 --> 01:55.120
And from a graphical perspective, from a browser,

40
01:55.120 --> 01:57.080
that would look like this.

41
01:57.080 --> 01:58.120
All right, fantastic.

42
01:58.120 --> 02:00.640
So all of our connectivity is currently in place.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

42
01:58.120 --> 02:00.640
So all of our connectivity is currently in place.

43
02:00.640 --> 02:02.520
So let's head over to our NSX manager,

44
02:02.520 --> 02:04.040
and with networking selected,

45
02:04.040 --> 02:06.920
let's take a quick peek at the network topology.

46
02:06.920 --> 02:10.160
So currently, if we double click on our tier zero gateway,

47
02:10.160 --> 02:12.360
it's gonna show us, point that tier zero gateway,

48
02:12.360 --> 02:14.440
we've already associated with edge one and edge two,

49
02:14.440 --> 02:17.520
that's two is logical interfaces on that 23 network.

50
02:17.520 --> 02:19.480
And currently edge one is active,

51
02:19.480 --> 02:22.840
and edge two is standby for our gateway zero services.

52
02:22.840 --> 02:24.800
So to implement our gateway policy,

53
02:24.800 --> 02:28.000
we click on security and a left under policy management,

54
02:28.000 --> 02:29.440
instead of going to distributed firewall,

55
02:29.440 --> 02:30.920
which we did in previous skills,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

55
02:29.440 --> 02:30.920
which we did in previous skills,

56
02:30.920 --> 02:33.760
we're now gonna click right here on gateway firewall.

57
02:33.760 --> 02:34.920
It's also giving us a notice here

58
02:34.920 --> 02:37.360
that we have identity firewall services turned off.

59
02:37.360 --> 02:38.960
So we're gonna do that in a separate skill

60
02:38.960 --> 02:40.600
with integration with the active directory.

61
02:40.600 --> 02:42.920
So I'm gonna say, please don't show me that again.

62
02:42.920 --> 02:44.320
So here on the security tab,

63
02:44.320 --> 02:47.400
with the left hand tab of gateway firewall selected,

64
02:47.400 --> 02:49.640
we can now choose from our various gateways.

65
02:49.640 --> 02:52.840
So here we have gateway zero, A and B and B star plan.

66
02:52.840 --> 02:54.960
We want this gateway firewall to be implemented

67
02:54.960 --> 02:57.160
on our tier zero gateway zero.

68
02:57.160 --> 02:59.280
So if we click here on all shared rules,

69
02:59.280 --> 03:02.080
very similar to the different categories we had
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

69
02:59.280 --> 03:02.080
very similar to the different categories we had

70
03:02.080 --> 03:03.400
in the distributed firewall,

71
03:03.400 --> 03:05.160
we also have multiple categories here

72
03:05.160 --> 03:06.920
for the gateway firewall.

73
03:06.920 --> 03:09.360
And they are processed from categories left to right,

74
03:09.360 --> 03:10.840
and then for each category,

75
03:10.840 --> 03:12.400
they're processed top to bottom.

76
03:12.400 --> 03:14.040
So currently under emergency, we have zero,

77
03:14.040 --> 03:15.880
system zero, pre-rule zero,

78
03:15.880 --> 03:17.960
and if we click right here on gateway specific,

79
03:17.960 --> 03:19.960
it's gonna whisk us away over here to this tab,

80
03:19.960 --> 03:21.720
right here called gateway specific rules.

81
03:21.720 --> 03:23.880
So if we click here on gateway specific,

82
03:23.880 --> 03:25.760
it moves us over to this tab right here.

83
03:25.760 --> 03:28.280
And currently with our tier zero gateway,

84
03:28.280 --> 03:30.480
we only have the default policy in place.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

84
03:28.280 --> 03:30.480
we only have the default policy in place.

85
03:30.480 --> 03:31.880
So on the left, I'm gonna go ahead

86
03:31.880 --> 03:33.720
and minimize the left hand column.

87
03:33.720 --> 03:35.440
That'll give us a little more room to work with.

88
03:35.440 --> 03:37.040
And if we wanna add our own policy,

89
03:37.040 --> 03:40.200
do permit HTTP traffic down to our web server.

90
03:40.200 --> 03:42.760
We can go ahead and right here and click on add policy.

91
03:42.760 --> 03:46.360
Let's call this our gateway HTTP policy.

92
03:46.360 --> 03:48.480
And then we'd add a rule that's permitting the traffic

93
03:48.480 --> 03:50.360
that we want to allow, which is the HTTP.

94
03:50.360 --> 03:53.960
So with our policy selected here, we'll click add rule.

95
03:53.960 --> 03:56.120
And we'll go ahead and rename this rule,

96
03:56.120 --> 03:58.920
and we'll call this permit HTTP to web 10.

97
03:58.920 --> 04:00.600
And then for the source, we'll go ahead and say
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

97
03:58.920 --> 04:00.600
And then for the source, we'll go ahead and say

98
04:00.600 --> 04:01.720
if it's coming from anywhere,

99
04:01.720 --> 04:04.040
so we don't really care about the source information.

100
04:04.040 --> 04:06.480
However, if it's trying to go to the destination

101
04:06.480 --> 04:08.640
of our web server, then we wanna go ahead

102
04:08.640 --> 04:10.680
and permit it if it's HTTP.

103
04:10.680 --> 04:12.160
So for destination right here,

104
04:12.160 --> 04:13.480
we'll click on the pencil.

105
04:13.480 --> 04:16.320
And currently we have a bunch of groups that we could use

106
04:16.320 --> 04:18.240
if that server was a member of one of those groups,

107
04:18.240 --> 04:20.400
or we could just go right here to IP addresses

108
04:20.400 --> 04:21.920
and put in the IP address.

109
04:21.920 --> 04:24.040
Now, when we sit up NAT, we told to go ahead

110
04:24.040 --> 04:25.840
and pay attention from a firewall perspective

111
04:25.840 --> 04:26.960
to the internal addresses.

112
04:26.960 --> 04:30.680
So if we wanted to match on traffic going to our web server,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

112
04:26.960 --> 04:30.680
So if we wanted to match on traffic going to our web server,

113
04:30.680 --> 04:33.400
right here, we'd put in 10.10.0.

114
04:33.400 --> 04:35.320
And its IP address is 181.

115
04:35.320 --> 04:37.360
So that would be the match for the destination

116
04:37.360 --> 04:38.660
as opposed to matching on a group.

117
04:38.660 --> 04:40.680
Or we could do this, let's click on apply here.

118
04:40.680 --> 04:41.960
Then we'll go ahead and save this real quick.

119
04:41.960 --> 04:42.840
Click on publish.

120
04:42.840 --> 04:45.720
We also could, if we wanted to go back to inventory,

121
04:45.720 --> 04:47.880
and I'll expand the left-hand column here

122
04:47.880 --> 04:49.760
and click on virtual machines.

123
04:49.760 --> 04:51.520
And from here, we could select a web 10.

124
04:51.520 --> 04:53.800
So let's go ahead and click on the three dots to edit it.

125
04:53.800 --> 04:55.680
And then if we wanted to, we could add the tag right here.

126
04:55.680 --> 04:57.480
So currently we have tags for client tag,

127
04:57.480 --> 05:00.200
DB tag, edge, odd, even, and servers.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

127
04:57.480 --> 05:00.200
DB tag, edge, odd, even, and servers.

128
05:00.200 --> 05:02.240
So I'm gonna go ahead and sign the tag right here of servers.

129
05:02.240 --> 05:03.960
I had to modify the resolution

130
05:03.960 --> 05:05.200
so it would actually show up there.

131
05:05.200 --> 05:06.640
And now with that servers tag selected,

132
05:06.640 --> 05:08.480
let me go ahead and click on save.

133
05:08.480 --> 05:10.200
And let me change the resolution back a little bit

134
05:10.200 --> 05:11.680
to make it easier to read.

135
05:11.680 --> 05:13.360
And now if we go back to security.

136
05:13.360 --> 05:16.320
And on the left, if we now select gateway firewall once again,

137
05:16.320 --> 05:17.840
and I'll collapse that left-hand side.

138
05:17.840 --> 05:20.000
So we're focused here on the gateway firewall

139
05:20.000 --> 05:21.680
for the T0 gateway.

140
05:21.680 --> 05:24.560
And there's our new policy, along with the new rule.

141
05:24.560 --> 05:25.560
So here for the destination,

142
05:25.560 --> 05:29.320
instead of specifying the actual IP address for that host,

143
05:29.320 --> 05:31.120
we can click on the edit here
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

143
05:29.320 --> 05:31.120
we can click on the edit here

144
05:31.120 --> 05:33.200
and go back to the IP address and remove it.

145
05:33.200 --> 05:35.040
And simply use a group membership.

146
05:35.040 --> 05:37.760
So because we had the tag called servers to that VM,

147
05:37.760 --> 05:39.080
if we now go to the server group,

148
05:39.080 --> 05:41.800
let me just verify here with clicking on view members,

149
05:41.800 --> 05:44.120
we should have web 10 showing up here as well.

150
05:44.120 --> 05:46.280
So now we're still matching our web 10

151
05:46.280 --> 05:47.440
as a member of this group.

152
05:47.440 --> 05:50.600
Either way is great, so we'll click on close and apply,

153
05:50.600 --> 05:53.160
and let me publish those changes as well before I forget.

154
05:53.160 --> 05:54.960
And then for services, we wanna go ahead

155
05:54.960 --> 05:58.360
and specify we want to allow HTTP traffic.

156
05:58.360 --> 06:00.160
Effectively TCP port 80,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

156
05:58.360 --> 06:00.160
Effectively TCP port 80,

157
06:00.160 --> 06:02.960
so we'll go ahead and type in HTTP press enter.

158
06:02.960 --> 06:04.520
And then we'll filter down to these service names

159
06:04.520 --> 06:05.680
that include HTTP.

160
06:05.680 --> 06:08.560
And we want this one right here, HTTP for TCP traffic

161
06:08.560 --> 06:11.400
to a destination port of 80 for the initial flow of traffic.

162
06:11.400 --> 06:13.720
So we'll select that, click on apply,

163
06:13.720 --> 06:15.400
and we want to permit that traffic.

164
06:15.400 --> 06:17.080
So we'll go ahead and publish that.

165
06:17.080 --> 06:19.840
Now even before we specify this rule of allow,

166
06:19.840 --> 06:21.760
that traffic as we just demonstrated a moment ago

167
06:21.760 --> 06:22.720
was still being allowed.

168
06:22.720 --> 06:26.000
And that's because we don't yet have anywhere any rules,

169
06:26.000 --> 06:29.480
either distributed firewall rules or gateway firewall rules

170
06:29.480 --> 06:31.720
that are otherwise preventing that traffic.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

170
06:29.480 --> 06:31.720
that are otherwise preventing that traffic.

171
06:31.720 --> 06:33.520
So if our goal is to permit the HTTP,

172
06:33.520 --> 06:34.800
but tonight everything else,

173
06:34.800 --> 06:36.280
we need to add yet another rule.

174
06:36.280 --> 06:39.400
So I'll choose our policy, click on add rule.

175
06:39.400 --> 06:41.960
In fact, let's just clone this one right here.

176
06:41.960 --> 06:43.560
So we'll just click on this rule right here,

177
06:43.560 --> 06:44.440
save this little work.

178
06:44.440 --> 06:46.560
And with that rule selected, we'll click on clone,

179
06:46.560 --> 06:49.080
and then I'm gonna drag that below the other rule.

180
06:49.080 --> 06:50.520
So the first rule right here permits it.

181
06:50.520 --> 06:53.160
And for this one, we want to deny everything else.

182
06:53.160 --> 06:56.280
So we'll just call it deny to web 10,

183
06:56.280 --> 06:58.000
and the source can be anywhere.

184
06:58.000 --> 07:00.920
And the destination is the server group where web 10 is.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

184
06:58.000 --> 07:00.920
And the destination is the server group where web 10 is.

185
07:00.920 --> 07:04.000
And it just occurred to me that we are also setting up policies

186
07:04.000 --> 07:06.440
concerning the other servers in that group as well.

187
07:06.440 --> 07:07.760
So I'm gonna modify,

188
07:07.760 --> 07:09.280
instead of using the server group there,

189
07:09.280 --> 07:11.840
I'm gonna go back in and simply put in the IP address

190
07:11.840 --> 07:16.360
of that one server, which is 10.10.0.181,

191
07:16.360 --> 07:18.240
and go back to groups and say, you know what?

192
07:18.240 --> 07:19.920
Please show only selected,

193
07:19.920 --> 07:21.480
and we don't want to include that group.

194
07:21.480 --> 07:24.520
And now we are being very accurate and concise

195
07:24.520 --> 07:27.040
with this rule and I'll do the same thing for the deny.

196
07:27.040 --> 07:28.480
So we'll click on the pencil,

197
07:28.480 --> 07:30.520
click here where it says show only selected,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

197
07:28.480 --> 07:30.520
click here where it says show only selected,

198
07:30.520 --> 07:33.480
remove that group, and then go ahead to IP addresses,

199
07:33.480 --> 07:37.200
and then put in 10.10.0.181, just like that,

200
07:37.200 --> 07:38.440
and click on apply.

201
07:38.440 --> 07:40.600
All right, so now it's only gonna affect traffic destined

202
07:40.600 --> 07:43.680
to that specific VM with that specific IP address,

203
07:43.680 --> 07:46.400
as opposed to the group, which included additional servers.

204
07:46.400 --> 07:47.560
And then for the services here,

205
07:47.560 --> 07:49.040
if we want to deny everything else,

206
07:49.040 --> 07:51.800
we want to go ahead and say HTTP,

207
07:51.800 --> 07:54.000
we'll go ahead and say show only selected,

208
07:54.000 --> 07:56.920
and we'll remove that and click on apply,

209
07:56.920 --> 07:58.600
and effectively now it's any services,

210
07:58.600 --> 08:00.600
so any port, any protocol,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

210
07:58.600 --> 08:00.600
so any port, any protocol,

211
08:00.600 --> 08:02.680
and we want to specify that that traffic should be rejected.

212
08:02.680 --> 08:06.280
So the first rule here, when it's hit at gateway zero,

213
08:06.280 --> 08:08.720
should permit HTTP to that IP address,

214
08:08.720 --> 08:10.320
and any other traffic trying to go

215
08:10.320 --> 08:12.440
to that specific IP address should be dropped.

216
08:12.440 --> 08:13.920
So we'll click on publish,

217
08:13.920 --> 08:16.440
and now that it's been updated, let's test it out.

218
08:16.440 --> 08:18.920
So here is our topology in the upper right-hand corner.

219
08:18.920 --> 08:22.440
Let's bring back in Mint 23 to test connectivity

220
08:22.440 --> 08:23.520
down to web 10.

221
08:23.520 --> 08:27.360
So here is Mint 23, we'll bring up a command prompt,

222
08:27.360 --> 08:31.600
and let's do a ping, or try a ping, down to 23.1.2.181,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

222
08:27.360 --> 08:31.600
and let's do a ping, or try a ping, down to 23.1.2.181,

223
08:31.600 --> 08:34.320
and that this Hnet is gonna lead down to web 10,

224
08:34.320 --> 08:37.000
earlier it worked, and now it's not,

225
08:37.000 --> 08:39.880
so do a control C, let's also do a curls,

226
08:39.880 --> 08:44.880
we'll type in C URL, dash I, going to 23.1.2.181, press enter,

227
08:44.880 --> 08:47.760
and that is working, and that's because

228
08:47.760 --> 08:51.560
we're permitting HTTP, so that's still working, that's great.

229
08:51.560 --> 08:53.760
However, if we tried doing a telnet,

230
08:53.760 --> 08:58.440
to 23.1.2.181, and going over to port 22,

231
08:58.440 --> 09:00.960
which we were able to open a connection earlier,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

231
08:58.440 --> 09:00.960
which we were able to open a connection earlier,

232
09:00.960 --> 09:03.240
now that's being denied, and that's because

233
09:03.240 --> 09:05.320
our gateway security policy rule right here,

234
09:05.320 --> 09:09.240
on tier zero gateway zero, and let's also try FTP,

235
09:09.240 --> 09:13.400
going to 23.1.2.181, and earlier when we tried that,

236
09:13.400 --> 09:14.960
it was giving us a prompt asking us

237
09:14.960 --> 09:16.800
for our username and password information,

238
09:16.800 --> 09:18.680
but now it's just getting a connection refuse,

239
09:18.680 --> 09:21.400
because the firewall, specifically the gateway firewall

240
09:21.400 --> 09:24.440
here on the tier zero gateway, was denying that traffic,

241
09:24.440 --> 09:26.880
and because the action for that rule was reject,

242
09:26.880 --> 09:29.280
it was sending a TCP reset back to this client,

243
09:29.280 --> 09:30.880
which is why we're seeing that right here.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

243
09:29.280 --> 09:30.880
which is why we're seeing that right here.

244
09:30.880 --> 09:33.280
And just to confirm, if we open a browser,

245
09:33.280 --> 09:37.840
on this Mint 23 machine, and we go to the IP address 23.1.2.181,

246
09:37.840 --> 09:39.680
and we click refresh a few times,

247
09:39.680 --> 09:41.440
sure enough that it's hitting that server,

248
09:41.440 --> 09:43.520
we can also verify that with the net rule

249
09:43.520 --> 09:44.880
inside NSX Manager.

250
09:44.880 --> 09:46.880
So here if we click on networking, on the left,

251
09:46.880 --> 09:49.400
if we go down to net, here's our destination net rule,

252
09:49.400 --> 09:51.240
right here, and if we scroll to the right,

253
09:51.240 --> 09:53.360
and click on the icon for stats,

254
09:53.360 --> 09:55.360
it's showing us zero active sessions,

255
09:55.360 --> 09:57.440
but let me go ahead and go to our client,

256
09:57.440 --> 09:59.880
and let me click on refresh a few times there,

257
09:59.880 --> 10:01.080
and then we'll click on refresh here,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

257
09:59.880 --> 10:01.080
and then we'll click on refresh here,

258
10:01.080 --> 10:02.240
and sure enough it's showing us

259
10:02.240 --> 10:03.880
that we have one active session,

260
10:03.880 --> 10:06.320
and that's our HTTP session that we have

261
10:06.320 --> 10:08.680
from that client on the outside that 23 network,

262
10:08.680 --> 10:10.920
coming down to the server at 10, 10, 0, 181,

263
10:10.920 --> 10:12.800
using this destination net rule.

264
10:12.800 --> 10:13.840
So we'll close that.

265
10:13.840 --> 10:16.440
And then going back to security here in the NSX Manager

266
10:16.440 --> 10:18.120
and to the gateway firewall,

267
10:18.120 --> 10:20.360
if we click on the icon for stats over here,

268
10:20.360 --> 10:21.800
where the actual rule itself,

269
10:21.800 --> 10:24.280
it generates statistics every 15 minutes.

270
10:24.280 --> 10:25.960
So if we waited up to 15 minutes,

271
10:25.960 --> 10:28.160
it would then show us an aggregate hit count

272
10:28.160 --> 10:30.440
regarding this rule for the past 15 minutes
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

272
10:28.160 --> 10:30.440
regarding this rule for the past 15 minutes

273
10:30.440 --> 10:31.920
that it's doing the aggregation for.

274
10:31.920 --> 10:33.520
However, even though it's not showing yet

275
10:33.520 --> 10:36.080
the hit counts and byte counts and packet counts up here,

276
10:36.080 --> 10:38.680
down here under max popularity and max session count,

277
10:38.680 --> 10:39.840
we have some hits there,

278
10:39.840 --> 10:41.600
and that's due to that rule being matched.

279
10:41.600 --> 10:42.600
So if we wait a few minutes,

280
10:42.600 --> 10:45.640
the aggregate numbers here would show up on the top row as well.

281
10:45.640 --> 10:47.760
And just to confirm that this rule really is hitting

282
10:47.760 --> 10:49.800
the traffic that's not HTTP traffic,

283
10:49.800 --> 10:52.640
if we disabled it for a moment and published it,

284
10:52.640 --> 10:53.920
and then we went back to our client,

285
10:53.920 --> 10:55.280
and we tried one of those tests again.

286
10:55.280 --> 10:56.760
So there's the tell net session,

287
10:56.760 --> 10:59.560
trying to open up on port 22, that's working.

288
10:59.560 --> 11:02.360
If you do our ping to that IP address, that's working.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

288
10:59.560 --> 11:02.360
If you do our ping to that IP address, that's working.

289
11:02.360 --> 11:04.480
And conversely, if we enable that rule again,

290
11:04.480 --> 11:07.080
that rejects everything that's not HTTP traffic

291
11:07.080 --> 11:08.080
and publish that,

292
11:08.080 --> 11:09.520
and then we go back to our client,

293
11:09.520 --> 11:11.320
those same types of traffic flows

294
11:11.320 --> 11:12.320
are now gonna be denied.

295
11:12.320 --> 11:14.360
So there's the ping that's not working,

296
11:14.360 --> 11:16.040
I'll do a control C there,

297
11:16.040 --> 11:18.160
and we'll go ahead and do the tell net to port 22,

298
11:18.160 --> 11:19.400
and that's being rejected.

299
11:19.400 --> 11:21.480
Again, because this rule is catching that traffic

300
11:21.480 --> 11:22.480
and stopping it.

301
11:22.480 --> 11:25.160
So in this video, we've implemented on Gateway Zero,

302
11:25.160 --> 11:28.120
a gateway firewall that permits H2 traffic

303
11:28.120 --> 11:29.880
if it's trying to go to this VM.

304
11:29.880 --> 11:32.200
However, all other traffic that's trying to go to that VM
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

304
11:29.880 --> 11:32.200
However, all other traffic that's trying to go to that VM

305
11:32.200 --> 11:34.960
is gonna be blocked right there at our tier zero,

306
11:34.960 --> 11:36.200
gateway zero firewall.

307
11:36.200 --> 11:59.800
[no audio]